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DETAILED ACTION 

This is a response to Applicant's request for continued examination filed on September 
11, 2007. Amendments filed on August 13, 2007 have been entered. Applicant has 
cancelled claims 11, 12, 15, and 16. Applicant has amended claims 1-3, 6, 8, 10, 13, 
14, 17, 19, 22, 27, 30, 38, 40, and 41. Claims 1-10, 13-14, 17-22, and 27-42 are 
currently pending. 

Response to Arguments 

1 . Applicant's arguments, see Remarks, filed on August 1 3, 2007, with respect to 
the rejection(s) of claim(s) 1-22 and 27-42 under 35 USC 103(a) have been fully 
considered and are persuasive. Therefore, the rejection has been withdrawn. 
However, upon further consideration, a new ground(s) of rejection is made in view of 
Trcka et al. [US PN 6453345 B2], previously cited Radatti et al. [US Pub No 
2001/0042214 A1], and Canion et al. [US Pub No. 2002/0108059 A1]. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

1. Claim 32 rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 
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a. Claim 32 recites the limitation "the" memory. There is insufficient 
antecedent basis for this limitation in the claim. The parent claim to which it 
refers does not mention any "memory." 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
. the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 USPQ 459 

(1966), that are applied for establishing a background for determining obviousness 

under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1. Claim 1-5, 7-9, 13-14, 17-20, 22, and 32 are rejected under 35 U.S.C. 103(a) as 

being unpatentable over Trcka et al. [US PN 6453345 B2] hereinafter Trcka, and further 

in view of Canion et al. [US Pub No. 2002/0108059 A1] hereinafter Canion. 

Regarding claim 1 , Trcka teaches a device for managing network traffic flow, the device 
comprising: a first module, the first module configured to receive network traffic content 
[US 6453345 B2, Col 9, Ln 13-15], determine whether a protocol of the network traffic 
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content matches a prescribed protocol of network traffic content that could contain 
content desired to be detected [US 6453345 B2, Col 15, Ln 47-52], and store the 
network traffic content in a stack when the protocol of the network traffic content 
matches the prescribed protocol [US 6453345 B2, Fig 3, Good-Data Cyclic Recorder, 
Bad-Data Cyclic Recorder]; and a second module associated with the stack, wherein 
the second module is configured to determine whether the network traffic content 
contains the content desired to be detected [US 6453345 B2, Fig 3, Surveillance Data 
Processing Module] [US 6453345 B2, Col 17, Ln 14-27]. 
Trcka does not explicitly teach that the modules be implemented as hardware or 
processor based modules. 

Canion teaches a device for managing network traffic flow, specifically a network 
security accelerator in which various modules are implemented as multiple hardware 
processing modules [US Pub No. 2002/0108059 A1, Pg 10, Par 0094]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
implement the modules as hardware multi-processing modules as taught by Canion. 
The modular design of Trcka enables this modification using ASIC or FPGA processors 
[US Pub No. 2002/0108059 A1, Fig 1C]. The suggestion/motivation would have been to 
improve system performance so as to enable parallel processing of data and/or 
communications to accelerate content delivery [US Pub No. 2002/0108059 A1, Par 
0094]. Trcka and Canion are analogous art because they are both in the field of 
network traffic security monitoring. 
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Regarding claim 2, the combined invention of Trcka and Canion teaches the device of 
claim 1, wherein the first processor comprises a general purpose processor [US Pub 
No. 2002/01 08059 A1 , Par 0097 - "Pentium"]. 

Regarding claim 3, the combined invention of Trcka and Canion teaches the device of 
claim 1, wherein the first processor comprises an ASIC processor [US Pub No. 
2002/0108059 A1, Par 01 19 - "ASIC"]. 

Regarding claim 4, the combined invention of Trcka and Canion teaches the device of 
claim 3, wherein the ASIC processor is a semi-custom ASIC processor. It is official 
notice that semi-custom ASIC processors are well known in the art of utilizing ASIC 
processors. 

Regarding claim 5, the combined invention of Trcka and Canion teaches the device of 
claim 3, wherein the ASIC processor is a programmable ASIC processor [The examiner 
notes that ASIC processors are programmable.] 

Regarding claim 13, the combined invention of Trcka and Canion teaches the device of 
claim 1, wherein the second processor comprises an ASIC processor [US Pub No. 
2002/0108059 A1 , Par 01 19 - "ASIC"]. 
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Regarding claim 7, the combined invention of Trcka and Canion teaches the device of 
claim 1, further comprising the stack [US 6453345 B2, Fig 3, Good-Data Cyclic 
Recorder, Bad-Data Cyclic Recorder - These recorders are stacks.]. 

Regarding claim 8, the combined invention of Trcka and Canion teaches the device of 
claim 7, wherein the stack is implemented in the first processor or in the second 
processor [US 6453345 B2, Fig 3, - Both Cyclic Recorders interact with the Archival 
Data Processing Module and the Surveilance Data Processing Module, and as such is 
implemented in the first processor or in the second processor.]. 

Regarding claim 9, the combined invention of Trcka and Canion teaches the device of 
claim 8, wherein the stack is configured to store the network traffic content in 
accordance with the protocol of the network traffic content [US 6453345 B2, Fig 6a, Fig 
6b]. 

Regarding claim 14, the combined invention of Trcka and Canion teaches the device of 
claim 1 , wherein the first or the second processor is further configured to flag the 
network traffic content when the protocol of the network traffic content matches the 
prescribed protocol, and send the flagged network traffic content to the memory [US 
6453345 B2, Col 15, Ln 47-52]. 
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Regarding claim 17, the combined invention of Trcka and Canion teaches the device of 
claim 14, wherein the second processor comprises an ASIC processor [US Pub No. 
2002/0108059 A1, Par 01 19 - "ASIC"]. 

Regarding claim 18, the combined invention of Trcka and Canion teaches the device of 
claim 1 , wherein the content desired to be detected is selected from the group 
consisting of a virus, a worm, a web content, a Trojan agent, an email spam, and a 
packet transmitted by a hacker [US 6453345 B2, Col 17, Ln 24-43]. 

Regarding claim 32, the combined invention of Trcka and Canion teaches the device of 
claim 1, further comprising the memory [US 6453345 B2, Fig 3 - "the" memory is 
interpreted as "a" memory]. 

Claim 19, 20, 22 is rejected because it contains the same subject matter since it is the 
method performing the device of claim 1, 9, 14. 

2. Claim 6, 10, 21, 27-31, and 33-42 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Trcka et al. [US PN 6453345 B2] hereinafter Trcka, and further in 
view of Radatti et al. [US Pub No 2001/0042214 A1] hereinafter Radatti, and Canion et 
al. [US Pub No. 2002/0108059 A1] hereinafter Canion. 
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Regarding claim 6, Trcka teaches the device of claim 1 , wherein the first module is 
further configured to send the network traffic content to a user regardless when the 
protocol of the network traffic content does or does not match the prescribed protocol. 
Trcka does not teach wherein the first module is further configured to send the network 
traffic content to a user only when the protocol of the network traffic content does not 
match the prescribed protocol. 

Radatti teaches wherein a module is further configured to send the network traffic 
content to a user only when the protocol of the network traffic content does not match 
the prescribed protocol [US Pub No. 2001/0042214 A1, Pg 3, Par 0036]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
modify the device of Trcka by configuring the first module to send the network traffic 
content to a user only when the protocol of the network content does not match the 
prescribed protocol as taught by Radatti. The suggestion/motivation for modifying 
would have been for having security preventive measures by having a process of 
intercepting suspect content that would be transparent have minimal impact on the 
performance of the computer and networking connections [US Pub No. 2001/0042214 
A1 , Pg 3, Par 0037]. Trcka and Radatti are analogous art because they are both in the 
same field of network securities. 

Trcka and Radatti does not explicitly teach that the modules be implemented as 
hardware or processor based modules. 
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Canion teaches a device for managing network traffic flow, specifically a network 
security accelerator in which various modules are implemented as multiple hardware 
processing modules [US Pub No. 2002/0108059 A1, Pg 10, Par 0094]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
implement the modules as hardware multi-processing modules as taught by Canion. 
The modular design of the combined inventions of Trcka and Radatti enables this 
modification using ASIC or FPGA processors [US Pub No. 2002/0108059 A1, Fig 1C]. 
The suggestion/motivation would have been to improve system performance so as to 
enable parallel processing of data and/or communications to accelerate content delivery 
[US Pub No. 2002/0108059 A1, Par 0094]. Trcka and Canion are analogous art 
because they are both in the field of network traffic security monitoring. 

Regarding claim 10, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 1 , wherein the first or the second processor is further configured to 
assemble the at least a portion of the network traffic content with the rest of the network 
traffic content, and transmit the network traffic content to a user when it is determined 
that the network traffic content does not contain the content desired to be detected [US 
Pub No. 2001/0042214 A1, Pg 3, Par 0037 - It would have been inherent to assemble 
the at least a portion of the network traffic content with the rest of the network traffic 
content by the proscribed code scanner to achieve transparency for returning 
acceptable code back to the user as taught by Radatti.]. 
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Claim 21 is rejected because it contains the same subject matter as claim 10, since it is 
the method performing the device of claim 10. 

Regarding claim 27, Trcka teaches a device for managing network traffic flow, the 
device comprising: a first module, the first module configured to receive network traffic 
content, flag the network traffic content, send the flagged network traffic content to a 
module, and send a copy of the network traffic content to a second module, the second 
module configured to determine whether the network traffic content contains content 
desired to be detected; and the second module. 

Trcka does not teach the module further configured to pass unflagged data to a user 
and prevent flagged data from being sent to the user. 

Radatti teaches a module configured to pass unflagged data to a user and prevent 
flagged data from being sent to the user [US Pub No. 2001/0042214 A1, Pg 3, Par 0036 
- The proscribed code scanner providing an indicator to the cyb_protocol if the code is 
acceptable reads on flagging of data.]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
modify the device of Trcka by having a module further configured to pass unflagged 
data to a user and prevent flagged data from being sent to the user as taught by 
Radatti. The suggestion/motivation for modifying would have been for having security 
preventive measures by having a process of intercepting suspect content that would be 



Application/Control Number: 10/624,941 Page 11 

Art Unit: 2132 

transparent have minimal impact on the performance of the computer and networking 
connections [US Pub No. 2001/0042214 A1 t Pg 3, Par 0037]. Trcka, Radatti, and 
Canion are analogous art because they are both in the same field of network securities. 

Trcka and Radatti does not explicitly teach that the modules be implemented as 
hardware or processor based modules. 

Canion teaches a device for managing network traffic flow, specifically a network 
security accelerator in which various modules are implemented as multiple hardware 
processing modules [US Pub No. 2002/0108059 A1, Pg 10, Par 0094]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
implement the modules as hardware multi-processing modules as taujght by Canion. 
The modular design of the combined inventions of Trcka and Radatti enables this 
modification using ASIC or FPGA processors [US Pub No. 2002/0108059 A1, Fig 1C]. 
The suggestion/motivation would have been to improve system performance so as to 
enable parallel processing of data and/or communications to accelerate content delivery 
[US Pub No. 2002/0108059 A1, Par 0094]. Trcka, Radatti, and Canion are analogous 
art because they are both in the field of network traffic security monitoring. 

Claim 28 is rejected because claim 10 contains the subject matter of claim 28. 
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Regarding claim 29, the combined inventions of Trcka and Radatti teaches the device of 
claim 27, wherein the module comprises a memory, a buffer, or at least a portion of a 
processor [US 6453345 B2, Fig 3]. 

Claim 30, 31 is rejected because it is the same subject matter as claim 27, 28. 

Regarding claim 33, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 27, wherein the first processor is configured to pass a portion of the 
network traffic content downstream before the second processor finishes processing the 
network traffic content [This claim is inherent since the unflagged portion of the network 
traffic content is passed downstream, while the flagged portion of the network traffic 
content is being quarantined and analyzed/examined for "undesirable/malicious" 
content.]. 

Regarding claim 36, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 27, wherein the first processor is configured to flag the network traffic 
content by modifying data associated with the network traffic content or by inserting 
data to the network traffic content [US PN 6453345 B2, Col 15, Ln 47-54]. 

Claim 37, 39 is rejected because it contains the same subject matter as claim 33, 36. 

Claim 40, 41 is rejected because it contains the same subject matter as claim 27, 28. 
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Regarding claim 42, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 40, wherein the first portion of the network traffic content is not scanned 
for the content that is desired to be detected [US Pub No. 2001/0042214 A1, Pg 3, Par 
0036]. 

Regarding claim 34, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 27, wherein the first processor and the second processor are parts of a 
processor [It is official notice that packaging a first processor and a second processor 
as a single processor is well known and common in the art.]. 

Regarding claim 35, the combined invention of Trcka, Radatti, and Canion teaches the 
device of claim 34, wherein the processor comprises an ASIC processor [US Pub No. 
2002/0108059 A1 , Par 01 19 - "ASIC"]. 

Regarding claim 38, the combined invention of Trcka, Radatti, and Canion teaches the 
method of claim 30, wherein the second processor comprises an ASIC processor [US 
Pub No. 2002/0108059 A1, Par 0119 - "ASIC"]. 
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Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Martin Jeriko P. San Juan whose telephone number is 
571-272-7875. The examiner can normally be reached on M-F 8:30a - 6:00p EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number, 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/MJSJ/ 
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Examiner. Art Unit 2132 
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